pip-audit

Spec sheet

Purpose

Audits Python environments, requirements files, and dependency trees for known security vulnerabilities.Read 11 Oct 2026 · github.com

Integrations

The project provides an official GitHub Action and supports pre-commit.Read 11 Oct 2026 · github.com

License

pip-audit is licensed under Apache 2.0.Read 11 Oct 2026 · github.com

Advisory sources

It can check vulnerabilities using PyPI or OSV services.Read 11 Oct 2026 · github.com

Automatic fixes

The --fix option can automatically upgrade vulnerable dependencies.Read 11 Oct 2026 · github.com

Input limitations

It does not process Pipfile or Pipfile.lock directly; the project suggests converting them to a supported requirements file.Read 11 Oct 2026 · github.com

Installation

The project says pip-audit requires Python 3.10 or newer and can be installed with pip; it also lists conda-forge as an installation option.Read 11 Oct 2026 · github.com

Output formats

Audit results can be emitted as columns, Markdown, JSON, CycloneDX JSON, or CycloneDX XML.Read 11 Oct 2026 · github.com

Private indexes

Interactive authentication to third-party package indexes is unsupported; pip keyring authentication is supported with limitations.Read 11 Oct 2026 · github.com

SBOM output

It can emit CycloneDX SBOMs in XML or JSON.Read 11 Oct 2026 · github.com

Security scope

It analyzes dependency trees, not source code, and does not claim to defend against malicious packages.Read 11 Oct 2026 · github.com

Vulnerability limitations

The project cautions that vulnerability feeds may contain noisy reports and that vulnerabilities in shared libraries may not be detected.Read 11 Oct 2026 · github.com

Plans and prices

Every pip-audit plan and price →

Where Specifiction places it

• Software Composition Analysis Software#51 of 657.2